Someone Registered a Domain That Looks Like Yours. Now What?

Picture this. Your accounts receivable clerk gets a call from a long-time supplier asking why their last two payments went to a new bank account. Nobody on your team sent new banking details. But someone did, from an email address one letter off from yours. That's what a lookalike domain makes possible, and it's one of the most common setups behind invoice fraud in Canada.

If you're reading this because Always Beyond told you a lookalike of your domain was just registered, take a breath. Nothing has necessarily gone wrong yet. A registered domain is a loaded tool, not a crime in progress. The goal now is to make it useless to whoever holds it.

This post explains what a lookalike domain is, why it matters when it has email set up, and the five practical steps that cut your risk the most, starting with the one people most often skip: telling your vendors, customers, and bank that the domain isn't yours. We've included a ready-to-send notice you can copy and customize.

What Is a Lookalike Domain?

A lookalike domain is a web address registered to resemble a real one closely enough that a busy person won't notice the difference. Criminals use them to send email that appears to come from you, or to host a fake copy of your website. Think of it like a counterfeit key cut to look like yours. It doesn't open your door, but it can fool the people who trust you.

💡  When a lookalike has mail records (sometimes shown as "has MX"), it's configured to send and receive email. That's the setup invoice fraud needs, which is why Always Beyond treats those alerts as high priority.

Why a Lookalike Domain Puts Your Money (and Your Partners') at Risk

Here's the uncomfortable part. Most lookalike fraud doesn't target you directly. It targets the people who pay you. A criminal emails your customer from the lookalike address, attaches a real-looking invoice, and asks them to send payment to "our new bank account." Your customer pays, you never receive the money, and both businesses lose time and trust sorting it out.

The same trick works in reverse. Your vendors might receive requests that appear to come from your accounts payable team, asking for statements, contacts, or changes to how you pay them. The Canadian Anti-Fraud Centre (CAFC) groups these attacks under spear phishing, and in 2025 they caused the second-highest dollar losses of any fraud type it tracks. Because so few victims report, the real number is much higher.

🚨  Your own email security can't protect a customer's inbox. If a lookalike sends fraudulent invoices to your clients, their filters are the only barrier, and a well-built lookalike often gets through. That's why warning them directly matters so much.

Step 1: Confirm What You're Dealing With

Not every similar domain is malicious. Some are owned by legitimate businesses with similar names, some are parked by speculators hoping to sell them, and some are freshly registered and waiting to be used. Before you raise alarms, it helps to know which you're facing.

• Does it have mail set up? A lookalike with mail records is far riskier than one without.
• Is there a website? A copy of your site, logo, or staff names is a strong sign of intent.
• When was it registered? A brand new registration that closely mimics you deserves attention.
• Is anyone already receiving email from it? Ask your front desk and accounting team.

Always Beyond checks these details for you as part of domain monitoring, so you get a clear recommendation rather than a raw alert. Please don't visit a suspicious site from a work device yourself or reply to anyone using the lookalike address.

Step 2: Warn Your Vendors, Customers, and Bank

This is the single most effective step, and it costs nothing. A short, calm notice to the people who send you money or receive payment from you closes the door criminals are trying to open. Banks and fraud specialists consistently recommend telling business partners not to accept changes to payment instructions without calling to confirm first.

1. List who matters most. Customers who pay you by EFT, vendors you pay regularly, your bank, your bookkeeper or accountant, and anyone who handles deposits or payroll.
2. Name the fake domain exactly. Spell it out so recipients can search their inbox and set a block rule.
3. State your real domain. Tell them every legitimate email from you comes from it, and only it.
4. Set the payment rule. You will never change banking details by email. Any change must be confirmed by phone using a number they already have on file.
5. Ask them to report anything odd. If they've already received messages from the lookalike, ask them to forward them to you as attachments and not click anything.

📋  Keep the notice short and factual. You aren't announcing a breach, because there hasn't been one. You're giving partners one simple rule that protects both of you.

Sample notice you can copy and customize

Replace everything in [square brackets], then send it from your real email address. Use BCC when sending to a group so you don't share your contact list.

For your most important relationships, a quick phone call on top of the email is worth it. If you're an Always Beyond client, we're happy to help you tailor the wording or build your send list.

Step 3: Tighten Your Own Payment Process

A lookalike domain is also a reminder to check how your team handles money requests. The best defences are boring, repeatable habits that work no matter how convincing an email looks.

• Callback verification. Any new payee or change in banking details gets confirmed by phone, using a number from your own records, never one in the email.
• Two-person approval. New EFT payees and large payments need a second set of eyes.
• Block the lookalike. Always Beyond can add the domain to your email filtering so nothing from it reaches your staff.
• A quick team briefing. Show staff the real and fake domains side by side. Thirty seconds of awareness goes a long way.

✅  Make "call before you change it" a written policy. When it's policy, nobody feels awkward asking, even when the request appears to come from the owner.

Step 4: Report It and Pursue a Takedown

You can ask to have a malicious lookalike suspended, but set expectations. Takedowns depend on evidence, and a domain that's registered but not yet used is hard to remove. Reporting still matters, because it builds a record and can stop the domain quickly once it's used for fraud.

⚠  For a .ca domain, the CIRA dispute process requires you to show rights in a mark in Canada that existed before the lookalike was registered, plus bad faith. A registered trademark makes this much easier. Talk to your lawyer before filing.

Don't contact the registrant directly or offer to buy the domain. It tips them off, can drive up the price, and doesn't stop them from registering another one tomorrow.

Step 5: Make the Next Lookalike Domain Harder to Use

You'll never register every possible variation of your name, but a few inexpensive moves reduce the odds and the damage.

• Register your closest variations. Your name in .ca and .com, plus the most obvious misspelling, costs little each year.
• Protect your real domain with email authentication. SPF, DKIM, and DMARC are settings that prove your email is really from you. They stop criminals from forging your exact address, which pushes them toward lookalikes that are easier to spot.
• Keep monitoring on. New lookalikes appear regularly. Early warning gives you time to notify partners before the first fake invoice goes out.
• Register your trademark. It strengthens any future dispute.

Quick Reference: What to Do in Each Situation

Frequently Asked Questions

Is registering a lookalike domain illegal?

Not by itself. Registering a domain is usually legal. Using it to impersonate you or defraud others is not, and registering it in bad faith can be challenged through dispute processes.

Should I just buy the domain from them?

Generally no. Paying rewards the behaviour, and there are thousands of other variations they can register next. Your money is better spent on defensive registrations and monitoring.

Will warning my customers make us look insecure?

In our experience, the opposite. Partners appreciate a heads-up, and a clear "we'll never change banking details by email" rule signals that you take their money seriously.

Doesn't DMARC stop this?

DMARC protects your exact domain from being forged. A lookalike is a different domain, so DMARC on yours doesn't block it. You still want DMARC in place, because it forces attackers onto lookalikes that people can learn to spot.

How long does a takedown take?

An abuse report for an active phishing site can work within days. A formal dispute typically takes weeks and involves fees. A domain that's registered but unused is often left alone until it's misused.

What if a customer already paid a fraudster?

They should contact their bank right away to try to recall the EFT, then report to local police and the CAFC. The first few hours matter most.

Got a lookalike alert and not sure what to do next? Always Beyond monitors client domains for new lookalikes, assesses the risk, blocks them in your email filtering, and helps you prepare the notice to your vendors and customers. Reach out to start the conversation.